CVE-2024-56201

Name	CVE-2024-56201
Description	Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1091329

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jinja2 (PTS)	bullseye	2.11.3-1	vulnerable
	bullseye (security)	2.11.3-1+deb11u2	vulnerable
	bookworm	3.1.2-1	vulnerable
	sid, trixie	3.1.3-1.1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jinja2	source	(unstable)	(unfixed)			1091329

Notes

https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699
https://github.com/pallets/jinja/issues/1792
Fixed by: https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f (3.1.5)